Malicious Calendly and Google Meet Links Deliver Weaponized Zoom Extension | Cybersecurity Alert 2025

Table of Contents

• Introduction
• What Happened?
• Anatomy of the Attack
• Why This Attack Works
• What Is a Weaponized Extension?
• Indicators of Compromise (IOCs)
• Preventive Measures
•  Conclusion
•  Frequently Asked Questions (FAQs)

Introduction

In the ever-evolving landscape of cyber threats, attackers are now exploiting the trust users place in productivity and scheduling tools. A recent campaign has surfaced where malicious actors leveraged Calendly and Google Meet invite links to deliver a weaponized Zoom extension, resulting in compromised systems and stolen data. This blog explores how the attack unfolded, its techniques, and how users—especially professionals using collaboration platforms—can stay protected.

What Happened?

The attack begins innocuously—an external contact sends a meeting invite via Telegram, requesting a virtual meeting through Calendly. The Calendly link redirects users to a Google Meet event that appears entirely legitimate.

However, during the fake meeting setup, the victim is prompted with a common issue: a request to download a Zoom extension to resolve an alleged microphone or audio problem. This Zoom extension, however, is weaponized malware.

The real goal? Gaining control over the victim’s system or extracting sensitive information, all while pretending to troubleshoot a harmless meeting issue.

Anatomy of the Attack

Let’s break down how this multi-stage attack works:

1. Initial Lure via Social Engineering

• The attacker reaches out over Telegram, posing as a professional contact.

• They send a Calendly link, requesting to set up a meeting.

2. Redirect to a Fake Google Meet Invite

• Clicking the link takes the victim to a fabricated Google Meet page.

  
  

• Everything looks authentic, including branding and scheduling details.

3. Zoom-Based Distraction

• The attacker claims there’s a microphone issue and requests the victim to download a Zoom extension.

• The link is weaponized—likely a trojanized installer or a malicious browser extension.

4. Malware Execution

• Once installed, the malware may:

  • Monitor browser activity

  • Steal credentials

  • Enable remote access

  • Capture webcam or microphone feeds

Why This Attack Works

This social engineering campaign is effective because it:

• Leverages trusted platforms like Calendly and Google Meet

• Exploits natural urgency (fixing an audio issue quickly before a meeting)

• Uses Telegram for informal, fast communication

• Delivers malicious payloads disguised as productivity tools (Zoom extension)

The attack bypasses many user suspicions because everything seems part of a normal workflow.

What Is a Weaponized Extension?

A weaponized extension is a browser or app extension that appears to serve a legitimate purpose but has hidden malicious functions such as:

• Logging keystrokes

• Extracting cookies or session tokens

• Redirecting websites

• Capturing browser content

• Installing persistent backdoors

In this case, the Zoom extension was modified to deliver one or more of these payloads.

Indicators of Compromise (IOCs)

Victims may observe the following signs:

• Unusual Zoom behavior (auto-launching, crashing)

• New browser extensions they didn’t install

• Unauthorized access to meetings or online accounts

• Increased CPU/network usage from unknown processes

• Password reset emails from services they never accessed

Preventive Measures

To protect against such campaigns, users should:

Conclusion

This campaign serves as a strong reminder that social engineering remains a core tactic for cybercriminals, especially when combined with tools people trust like Calendly, Google Meet, and Zoom. As attackers become more creative, it’s essential for individuals and organizations to develop a proactive cybersecurity posture. By validating every invite and treating unexpected downloads with suspicion, users can avoid falling into traps—even those disguised as routine meetings.

Stay safe, stay skeptical, and never download extensions unless you’re absolutely sure of their origin.

FAQs 

What is a weaponized Zoom extension?

A weaponized Zoom extension is a fake or modified browser/app plugin designed to appear legitimate but secretly installs malware or spyware on the victim's device.

How does the Calendly and Google Meet attack work?

The attacker sends a Calendly link via Telegram, redirecting to a fake Google Meet invite. Victims are then asked to download a Zoom extension, which is malicious and compromises the system.

Is this attack targeting specific users?

Yes, this campaign primarily targets business professionals or employees who frequently use Calendly, Google Meet, and Zoom for virtual meetings.

What data can be stolen using this Zoom extension malware?

Stolen data may include login credentials, browser cookies, microphone/camera access, financial data, and other personally identifiable information (PII).

How can I prevent being tricked by fake Zoom extensions?

Always verify meeting requests from unknown contacts, avoid downloading extensions during virtual calls, and use browser and endpoint security tools to block malicious downloads.

Are Calendly and Google Meet safe to use?

Yes, they are safe platforms when used correctly. The issue arises when attackers spoof these services using phishing links. Always confirm URLs before clicking.

What platforms are being used in this cyber attack?

Calendly, Google Meet, and Zoom are used as decoys, while Telegram is typically the messaging platform to initiate contact and send malicious links.

What tools help detect weaponized extensions?

Use tools like endpoint detection & response (EDR), antivirus scanners, browser extension managers, and behavioral analytics software.

How do I know if I downloaded a malicious Zoom extension?

Signs include system slowdowns, Zoom behaving unexpectedly, unknown extensions in your browser, and unauthorized account activity.

What to do if I clicked on a suspicious Calendly or Zoom link?

Immediately disconnect from the internet, scan your system with antivirus tools, remove suspicious extensions, and change your passwords.